API Overview

The CVD Portal REST API gives programmatic access to a part of the portal functions. The API needs the Enterprise plan, except GET /compliance/next-task and GET /compliance/next-deadline, which work on the Reporting plan or higher. Each request uses a Bearer API key. See API Authentication.

Endpoints

All paths start with /api/v1.

Method and path	Purpose	Scope
POST /vulnerabilities	Submit a vulnerability report	submissions:write
GET /vulnerabilities/export	Export up to 100 reports as JSON	read
GET /vulnerabilities/{id}/article14	Read the Article 14 status of a report	read
GET, POST /products	List or create products	read, products:write
GET, POST /sbom	Read SBOM metadata or push an SBOM	read, sbom:write
POST /scan/sarif	Push SARIF scan findings	sarif:write
GET /compliance/status	Read the compliance status	read
GET /compliance/gaps	Read the open compliance gaps	read
GET /compliance/next-task, GET /compliance/next-deadline	Read the next task or deadline	read
GET /compliance/mappings	Read the CRA requirement mappings	read
GET, POST /compliance/assessments, GET /compliance/assessments/oscal	Read or start assessments, export OSCAL	read and others
POST /jobs, GET /jobs/{id}	Start and read background jobs	varies
POST /webhooks/register	Register a webhook	webhooks:write
GET /gdpr/export	Export all company data as JSON	gdpr:export

Limits

• The API cannot change a report after you create it. For example, it cannot update the status or the CVSS score.
• For AI agents, CVD Portal also has an MCP server. See MCP Server.